CVE-2021-34501

What it actually does

This vulnerability is a Microsoft Excel remote code execution flaw triggered by opening or previewing a malicious Excel/Office document. The CVSS vector indicates local execution with no privileges required but user interaction required: an attacker must convince a user to open a crafted file, after which code can execute in the context of the affected user. Successful exploitation can compromise confidentiality, integrity, and availability of the endpoint and any data or network resources accessible to that user. Affected product families include Microsoft Excel, Microsoft Office, Microsoft 365 Apps, and Office Online Server.

Why it matters to the business

If exploited, this flaw can turn a routine spreadsheet into an endpoint compromise, enabling malware installation, credential theft, data exfiltration, lateral movement, or business disruption. The risk is most relevant to organizations that exchange Office documents through email, web downloads, collaboration platforms, or file shares. Although it is not listed in CISA KEV and no exploit maturity is provided, the EPSS score is relatively elevated, so unpatched Office deployments should still be treated as a meaningful phishing-delivered code execution risk.

How an attack unfolds

An attacker prepares a specially crafted Excel or Office document that abuses the vulnerability in the Office/Excel parsing or rendering path. The attacker then delivers the file through phishing email, a compromised website, file-sharing service, or another social-engineering channel. When a user opens or potentially previews the file using a vulnerable Microsoft Excel, Microsoft Office, Microsoft 365 Apps, or Office Online Server component, the malicious content triggers the vulnerability and executes attacker-controlled code under the user's security context. From there, the attacker may launch a payload such as a downloader, remote access tool, credential stealer, or script interpreter, then establish persistence, collect credentials, access files, and attempt lateral movement depending on endpoint controls and user privileges.

How to fix it

Apply the relevant Microsoft security updates for Microsoft Excel, Microsoft Office, Microsoft 365 Apps, and Office Online Server from the July 2021 security release or later cumulative updates. Because exact fixed package versions were not provided, validate remediation against Microsoft Security Update Guide entries for CVE-2021-34501 and the deployed Office update channel. For Microsoft 365 Apps, ensure clients are on a supported update channel and have received a build containing the July 2021 fixes or later. For Office Online Server, apply the applicable security update and confirm the server build is current. Where immediate patching is not possible, reduce exposure by blocking untrusted Office attachments, disabling Office macros where not required, using Protected View/Application Guard for Office, restricting child process creation from Office applications, and enforcing endpoint detection controls for suspicious Office-spawned processes.

How to confirm the fix worked

Confirm that all affected Microsoft Excel, Office, Microsoft 365 Apps, and Office Online Server installations have the July 2021 security update or a later cumulative update installed. On endpoints, check Office build and update channel through Microsoft 365 Apps admin tooling, inventory platforms, endpoint management, or local Office account/update information. On servers, verify Office Online Server patch level through installed updates, build numbers, and Microsoft guidance. Validate that email and web controls detonate or block suspicious Office documents, and confirm endpoint controls alert on or block Office applications spawning command shells, script interpreters, download utilities, or unsigned binaries. If mitigation policies were applied, test them with benign simulations that attempt Office child-process creation and macro/script execution to ensure controls are effective.

Typical attack path

1. Attacker identifies users likely to open spreadsheet attachments or links.
2. Attacker crafts a malicious Excel/Office document designed to trigger the vulnerability.
3. Attacker delivers the document through phishing, web download, shared drive, or collaboration platform.
4. User opens or previews the malicious document on a vulnerable Office/Excel installation or affected Office service.
5. The vulnerability is triggered and attacker-controlled code executes in the user's context.
6. Malware, script interpreters, or living-off-the-land tools are launched to download or execute follow-on payloads.
7. Attacker attempts credential theft, persistence, data access, and lateral movement using the compromised endpoint or user session.

How to detect it

Investigate whether exploitation already occurred by correlating email security logs, endpoint telemetry, process creation events, file creation events, proxy/DNS logs, and Office telemetry. Focus on users who opened external Excel attachments or downloaded spreadsheets shortly before suspicious process execution. In Windows Security logs and EDR process telemetry, look for EXCEL.EXE or other Office processes spawning command shells, scripting engines, HTML application hosts, DLL loaders, archive tools, or download utilities. Review attachments and downloaded files with Excel extensions from untrusted senders, especially if followed by outbound connections, new executables in user-writable directories, scheduled tasks, Run key changes, or credential-access tooling. For Office Online Server, review web/server logs and process execution telemetry for abnormal document rendering activity followed by unexpected child processes or outbound connections. No CVE-specific exploit string is available from the provided data, so detections should emphasize behavioral indicators of Office-document exploitation.

• EXCEL.EXE spawning cmd.exe
• EXCEL.EXE spawning powershell.exe
• EXCEL.EXE spawning pwsh.exe
• EXCEL.EXE spawning wscript.exe
• EXCEL.EXE spawning cscript.exe
• EXCEL.EXE spawning mshta.exe
• EXCEL.EXE spawning rundll32.exe
• EXCEL.EXE spawning regsvr32.exe
• EXCEL.EXE spawning certutil.exe
• EXCEL.EXE spawning bitsadmin.exe
• EXCEL.EXE spawning msiexec.exe
• EXCEL.EXE spawning schtasks.exe
• WINWORD.EXE spawning powershell.exe
• POWERPNT.EXE spawning powershell.exe
• soffice.exe spawning cmd.exe
• %TEMP%\*.xls
• %TEMP%\*.xlsx
• %TEMP%\*.xlsm
• %USERPROFILE%\Downloads\*.xls
• %USERPROFILE%\Downloads\*.xlsx
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
• Event ID 4688 EXCEL.EXE powershell.exe
• Event ID 4688 EXCEL.EXE cmd.exe
• Event ID 1 EXCEL.EXE powershell.exe
• Event ID 1 EXCEL.EXE mshta.exe

What your security team should do

• Prioritize patch verification for all Microsoft Excel, Microsoft Office, Microsoft 365 Apps, and Office Online Server deployments, especially systems handling external documents.
• Use centralized inventory to identify unsupported or stale Office update channels and move them to supported builds containing the July 2021 or later security fixes.
• Harden Office execution behavior by enabling Protected View, blocking macros from the internet, and restricting Office applications from creating child processes where business-compatible.
• Tune EDR/SIEM detections for Excel or Office processes launching cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or network download tools.
• Review historical email, proxy, EDR, and file telemetry for suspicious spreadsheet attachments or Office-spawned payload activity around users who opened external Excel files.
• Educate users and mail handlers to treat unexpected spreadsheets, especially those requesting editing/content enablement or delivered from external sources, as high risk.
• For Office Online Server, verify internet exposure, apply current patches, and restrict access to trusted services where possible.